Previously, network intrusion detection technologies can determine that there are security problems, for example, an attack, a configuration problem, or a vulnerability, related to a particular computer system or network device. For example, network intrusion detection technologies and network intrusion prevention technologies such as Sourcefire SNORT sensors can analyze network traffic to notice attacks. As another example, Sourcefire RNA technology can maintain a list of IP (Internet Protocol) addresses and corresponding configurations, such as operating system, services, client applications, TCP (transmission control protocol) and UDP (user datagram protocol) protocols, and the like. Thus, a security administrator can obtain information about which particular systems have experienced attacks, or have problematic configurations, or have vulnerabilities.
A security administrator might want to talk to the user that operates the system having the security problems, for example, to discuss the user's activities, such as opening of e-mails, visiting of internet sites, installing the latest virus software, or other reasons regarding the user's actions or inaction which may affect or compromise security. In practice, to track the computers of individual users, administrators typically maintain a spreadsheet of computers assigned to users. Unfortunately, computers tend to be shuffled between users at an organization without necessarily informing the administrators. Consequently, the administrators' spreadsheets tend to not reflect the current user. The security administrator does not have the capability readily to find out which user is actually connected to various activities which cause security problems.
Other available technology includes software which can match network traffic to a user which logged in, for example eTelemetry™ “LOCATE” software, which outputs a user name and IP address pair. However, users can log in to different machines. Moreover, such software does not track when the user logs out. Hence, an administrator that attempted to utilize the information output by the network intrusion detection/prevention system as well as the output from the eTelemetry software would have great difficulty determining with any certainty which user is responsible for the security problems.